Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Now my windows 7 is too slow and crashing usually. I checked the start up folder. I get a file with extension .ini. The content of file is

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183

Is this dangerous?

share|improve this question
    
Is the file called desktop.ini? –  CodesInChaos Mar 8 '13 at 17:22
    
Yes. The file contents you have pasted is that of a typical desktop.ini file that is commonly present in every folder to maintain visual settings of that folder. –  void_in Mar 8 '13 at 17:45

2 Answers 2

up vote 3 down vote accepted

This is a typical Desktop ini file that normally saves the folder view settings such as the background image etc. If suspect some malware is executing on the Windows startup, it might be executing from

  1. Run and RunOnce keys in the registry
  2. Windows Services
  3. Windows drivers
  4. DLL hijacking (placing itself in a path that comes before the legitimate DLL)
  5. Registry key of the registered shell extensions
  6. Hidden file or shortcut in the startup folder

There might be other locations as well so your best bet is quarentine the machine and follow the standard procedure of malware cleanup. You will find plenty of examples on how to cleanup a malware infected machine on SE and other forums.

share|improve this answer

Just to clarify since void_in's answer didn't say it directly. No, that file is perfectly normal and safe. INI files are just configuration files that are used to store settings. They can not be executed on their own, though some viruses can work by adding values to certain INI files to make a legitimate program do their dirty work. The contents of the INI file you have listed appear normal however.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.